swapped out addslashes()

replaced with mysql_real_escape_string(). Ready for testing.